feat: add llamafactory template

[phala-agent]

Summary

• Add llamafactory prebuilt template for hiyouga/LlamaFactory.
• Default runtime is a CPU-safe source verifier API on port 8080, not full training/inference.
• Add upstream logo icon at templates/icons/llamafactory.png.

Upstream

• Repository: https://github.com/hiyouga/LlamaFactory
• Icon source: upstream assets/logo.png from the README/tree
• Deployable assets are routed through: https://github.com/Phala-Network/phala-cloud/tree/main/templates/prebuilt/llamafactory

Template files

• templates/prebuilt/llamafactory/docker-compose.yml
• templates/prebuilt/llamafactory/README.md
• templates/icons/llamafactory.png
• templates/config.json

Environment variables

• LLAMAFACTORY_REF (optional, default v0.9.4): upstream Git tag, commit, or simple branch ref used by the verifier.

No credentials are required for the default smoke demo. README documents optional production env vars such as HF_TOKEN, WANDB_API_KEY, SWANLAB_API_KEY, API_KEY, MODEL_NAME_OR_PATH, and DATASET without real secret values.

Validation

• python3 sdks/templates/validate.py ✅
• git -C sdks diff --check origin/main...HEAD ✅
• docker compose -f sdks/templates/prebuilt/llamafactory/docker-compose.yml config >/tmp/llamafactory-compose-config.out ✅
• Static audit ✅
  • README has deployment, usage, and verification sections
  • config ID is unique
  • config repo points to the Phala prebuilt path
  • icon file exists and has a valid PNG signature
  • compose has public port 8080
  • no env_file, external build, host bind mounts, Docker socket, host networking, host IPC directive, privileged mode, or literal secrets

Runtime smoke

Local direct Python verifier smoke (without Docker daemon) ✅

• /healthz returned ok=true, status=ready
• Upstream ref v0.9.4, LlamaFactory version 0.9.4
• 13 upstream files checked, 7 Python sources compiled, 0 source-check errors
• /demo returned ok=true
• /v1/models returned OpenAI-compatible empty model list

Phala Cloud deployment smoke ✅

• Profile/workspace: hermes-admin-cvm-check
• Instance type: tdx.small
• Smoke name: auto-template-test-llamafactory-0527-115548
• CVM/VM UUID: 206df375-da1d-41da-b7a8-0c6a832d6655
• App ID: 8f332823a9623230822f1fb94b33cafb910b7f1b
• phala ps showed /dstack-app-1 running and healthy
• Endpoint: https://8f332823a9623230822f1fb94b33cafb910b7f1b-8080.dstack-pha-prod7.phala.network
• GET /healthz HTTP 200 with ok=true, status=ready, source_check.errors=[]
• GET /demo HTTP 200 with ok=true, cpu_only=true
• GET /v1/models HTTP 200 with object=list, data=[]

Cleanup

• Temporary CVM delete returned success.
• Follow-up lookup returned not found, confirming cleanup.

[phala-agent]

cc @Marvin-Cypher for review.

[Marvin-Cypher]

Reviewed template files, normalized tags, compose config, config validation, stale path cleanup, and compose safety scan. Checks are passing.